Apple's faith based security takes another hit

A security flaw, er feature, in Apple's iPhone OS allows ID thieves to trick the iPhone into thinking it is looking at a legitimate site.

Insecurity researcher Nitesh Dhanjani has been showing off how criminals can easily hide the true URL of a site from users by building a malicious Web application. Dhanjani showed how legitimate Web applications such as Bank of America's mobile banking application hide Safari's address bar after rendering the page.

Developers have to use this technique often because of the limited screen real estate on mobile devices like the iPhone. But Identity thieves and scammers could apply the same practice to conceal the actual URL of a fake site they've created and then duped users into visiting.

Dhanjani has reported the problem to Apple but it had not given any indication that they would fix the problem. Apple needs to modify iOS to prevent Web applications from hiding the URL, he said.

Dhanjani uncovered an Apple Safari vulnerability in 2008 that could be exploited with "carpet bomb" attacks. Apple initially told Dhanjani that it didn't consider the problem a security issue, it later issued a patch after others, including Microsoft, warned users to stop running Safari.

Jobs' Mob continues to claim it does not have security problems and that viruses only happen on Windows machines.